SAP Security Note
High priority
SAP security note 1504122, "CM: Potential Directory Traversal ICL_ICLCLAIMDATA_UPLOAD", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal in the program ICL_ICLCLAIMDATA_UPLOAD.
Solution
Please refer to Note 1497003 for additional information and instructions. The corrections from this note are a prerequisite for the implementation of this note.
The logical file name ICLSUP is used in this solution, using the logical file path ICLSUP.
Reason and prerequisites
The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
References
This note refers to
Affected components
- INSURANCE: Versions 471, 472, 600, 602, 603, 604, 605
Full note on SAP: SAP Support Launchpad note 1504122
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
